Desktop (macOS): session refresh token revoked server-side seconds after sign-in when resuming a thread on gpt-daybreak-blue-latest — repeated forced-logout loop

Summary

Codex Desktop (macOS) enters a repeated forced-logout loop: every fresh sign-in has its refresh token revoked server-side within seconds-to-minutes, reproducibly tied to resuming a thread that uses the gpt-daybreak-blue-latest model (the account has the corresponding access approval). Related to the symptom families in #25443 and #31459, but with a clear reproducible trigger and timeline.

Environment

• macOS 15.x (Darwin 25.5.0), Apple Silicon
• Codex Desktop client 26.818.31338 (runtime bundle 26.819.11345), codex app-server 0.149.0
• Auth mode: ChatGPT sign-in
• Single machine, single install; system clock verified against NTP (offset +0.11s)

Repro / timeline (all times UTC, from app-server logs)

1. Sign in fresh → token issued, works.
2. App auto-resumes the last thread. If that thread uses gpt-daybreak-blue-latest, the next /responses call coincides with the whole token family being revoked:

07:45:27  thread/resume (thread using gpt-daybreak-blue-latest) → POST /responses
07:45:28  ERROR Failed to refresh token: 401 Unauthorized:
          {"error":{"message":"Your refresh token has been invalidated. Please try signing in again.",
           "type":"invalid_request_error","code":"refresh_token_invalidated"}}

3. Electron layer then reports auth_status_result hasToken=false nullReason=auth_token_missing tokenExpiryState=missing and every subsequent backend-api call 401s (token_invalidated, token_revoked variants).
4. User is logged out. Signing in again repeats the cycle (~10 consecutive sessions in one hour on Aug 21; the ChatGPT security page fills with a new dead "Codex" session every ~2 minutes).

Sessions using standard models (gpt-5.6-sol/terra/luna) are unaffected.

Ruled out client-side

• Deleted ~/.codex/auth.json (recreated cleanly on sign-in)
• Wiped ~/Library/Application Support/com.openai.codex (Electron token store / Codex Safe Storage)
• Logged out all sessions from the ChatGPT security page
• Updated the app; no second OpenAI app installed; no Codex CLI usage
• Deleted the stale remote_control_enrollments row in state_5.sqlite (the app re-enrolls automatically ~3s after sign-in, so this cannot be cleared by the user either — arguably its own bug: while the stale enrollment existed, the client replayed its revoked token against /backend-api/wham/remote/control/server/refresh on every reconnect attempt)

Expected behavior

• If a model request is not authorized for the account, return a scoped error for that request — not a server-side revocation of the session's entire refresh-token family.
• The desktop app should surface why the session ended instead of silently looping to the login screen.
• Remote-control enrollment should stop replaying a token the server has already reported as revoked (it retries indefinitely with backoff, which looks like refresh-token reuse and may itself trigger family revocation).

Happy to provide full sanitized logs (logs_2.sqlite extracts, Electron desktop logs) on request.

Start with the app-server 0.149.0 authentication flow around POST /responses and the remote-control refresh endpoint /backend-api/wham/remote/control/server/refresh. Reproduce the listed resume timeline using the sanitized app-server and Electron logs, then determine whether the revocation is tied to model authorization or repeated enrollment refreshes. Done means the triggering request produces a scoped failure without revoking the session and revoked enrollment tokens stop being retried.